From 4e24a8bf6eb70c96a12db2adfa8c8f79b979d54c Mon Sep 17 00:00:00 2001 From: FusionPBX Date: Sun, 3 Jun 2018 17:42:57 -0600 Subject: [PATCH] Update dialplans.php --- app/dialplans/dialplans.php | 50 ++++++++++++++++++------------------- 1 file changed, 25 insertions(+), 25 deletions(-) diff --git a/app/dialplans/dialplans.php b/app/dialplans/dialplans.php index 76bd52ba09..c2205c6752 100644 --- a/app/dialplans/dialplans.php +++ b/app/dialplans/dialplans.php @@ -122,7 +122,7 @@ $rows_per_page = ($_SESSION['domain']['paging']['numeric'] != '') ? $_SESSION['domain']['paging']['numeric'] : 50; $param = ""; - if (strlen($app_uuid) > 0) { $param = "&app_uuid=".$app_uuid; } + if (strlen($app_uuid) > 0 && is_uuid($app_uuid)) { $param = "&app_uuid=".$app_uuid; } $page = $_GET['page']; if (strlen($page) == 0) { $page = 0; $_GET['page'] = 0; } list($paging_controls, $rows_per_page, $var_3) = paging($num_rows, $param, $rows_per_page); @@ -214,7 +214,7 @@ echo " \n"; echo " \n"; echo "
\n"; - echo " "; + echo " "; if (strlen($app_uuid) > 0) { echo " "; } @@ -263,12 +263,12 @@ if (permission_exists('dialplan_delete') && $result_count > 0) { echo ""; } - echo th_order_by('dialplan_name', $text['label-name'], $order_by, $order, $app_uuid, null, (($search != '') ? "search=".$search : null)); - echo th_order_by('dialplan_number', $text['label-number'], $order_by, $order, $app_uuid, null, (($search != '') ? "search=".$search : null)); - echo th_order_by('dialplan_context', $text['label-context'], $order_by, $order, $app_uuid, null, (($search != '') ? "search=".$search : null)); - echo th_order_by('dialplan_order', $text['label-order'], $order_by, $order, $app_uuid, "style='text-align: center;'", (($search != '') ? "search=".$search : null)); - echo th_order_by('dialplan_enabled', $text['label-enabled'], $order_by, $order, $app_uuid, "style='text-align: center;'", (($search != '') ? "search=".$search : null)); - echo th_order_by('dialplan_description', $text['label-description'], $order_by, $order, $app_uuid, null, (($search != '') ? "search=".$search : null)); + echo th_order_by('dialplan_name', $text['label-name'], $order_by, $order, $app_uuid, null, (($search != '') ? "search=".escape($search) : null)); + echo th_order_by('dialplan_number', $text['label-number'], $order_by, $order, $app_uuid, null, (($search != '') ? "search=".escape($search) : null)); + echo th_order_by('dialplan_context', $text['label-context'], $order_by, $order, $app_uuid, null, (($search != '') ? "search=".escape($search) : null)); + echo th_order_by('dialplan_order', $text['label-order'], $order_by, $order, $app_uuid, "style='text-align: center;'", (($search != '') ? "search=".escape($search) : null)); + echo th_order_by('dialplan_enabled', $text['label-enabled'], $order_by, $order, $app_uuid, "style='text-align: center;'", (($search != '') ? "search=".escape($search) : null)); + echo th_order_by('dialplan_description', $text['label-description'], $order_by, $order, $app_uuid, null, (($search != '') ? "search=".escape($search) : null)); echo ""; if ($app_uuid == "c03b422e-13a8-bd1b-e42b-b6b9b4d27ce4" && permission_exists('inbound_route_add')) { echo "$v_link_label_add"; @@ -291,7 +291,7 @@ echo "\n"; echo "\n"; - if ($result_count > 0) { + if (is_array($dialplans)) { foreach($dialplans as $row) { //get the application id @@ -309,7 +309,7 @@ } if ($app_uuid == "4b821450-926b-175a-af93-a03c441818b1" && permission_exists('time_condition_edit')) { - $tr_link = "href='".PROJECT_PATH."/app/time_conditions/time_condition_edit.php?id=".$row['dialplan_uuid'].(($app_uuid != '') ? "&app_uuid=".$app_uuid : null)."'"; + $tr_link = "href='".PROJECT_PATH."/app/time_conditions/time_condition_edit.php?id=".escape($row['dialplan_uuid']).(($app_uuid != '') ? "&app_uuid=".escape($app_uuid) : null)."'"; } elseif ( ($app_uuid == "c03b422e-13a8-bd1b-e42b-b6b9b4d27ce4" && permission_exists('inbound_route_edit')) || @@ -317,16 +317,16 @@ ($app_uuid == "16589224-c876-aeb3-f59f-523a1c0801f7" && permission_exists('fifo_edit')) || permission_exists('dialplan_edit') ) { - $tr_link = "href='dialplan_edit.php?id=".$row['dialplan_uuid'].(($app_uuid != '') ? "&app_uuid=".$app_uuid : null)."'"; + $tr_link = "href='dialplan_edit.php?id=".escape($row['dialplan_uuid']).(($app_uuid != '') ? "&app_uuid=".escape($app_uuid) : null)."'"; } echo "\n"; if (permission_exists("dialplan_delete")) { - echo " \n"; - $dialplan_ids[] = 'checkbox_'.$row['dialplan_uuid']; + echo " \n"; + $dialplan_ids[] = 'checkbox_'.escape($row['dialplan_uuid']); } echo " "; if ($app_uuid == "4b821450-926b-175a-af93-a03c441818b1" && permission_exists('time_condition_edit')) { - echo "".$row['dialplan_name'].""; + echo "".escape($row['dialplan_name']).""; } elseif ( ($app_uuid == "c03b422e-13a8-bd1b-e42b-b6b9b4d27ce4" && permission_exists('inbound_route_edit')) || @@ -334,22 +334,22 @@ ($app_uuid == "16589224-c876-aeb3-f59f-523a1c0801f7" && permission_exists('fifo_edit')) || permission_exists('dialplan_edit') ) { - echo "".$row['dialplan_name'].""; + echo "".escape($row['dialplan_name']).""; } else { - echo $row['dialplan_name']; + echo escape($row['dialplan_name']); } echo " \n"; - echo " ".((strlen($row['dialplan_number']) > 0) ? format_phone($row['dialplan_number']) : " ")."\n"; - echo " ".$row['dialplan_context']."\n"; - echo " ".$row['dialplan_order']."\n"; + echo " ".((strlen($row['dialplan_number']) > 0) ? escape(format_phone($row['dialplan_number'])) : " ")."\n"; + echo " ".escape($row['dialplan_context'])."\n"; + echo " ".escape($row['dialplan_order'])."\n"; echo " "; - echo " ".$text['label-'.$row['dialplan_enabled']]."\n"; + echo " ".$text['label-'.$row['dialplan_enabled']]."\n"; echo " \n"; - echo " ".((strlen($row['dialplan_description']) > 0) ? $row['dialplan_description'] : " ")."\n"; + echo " ".((strlen($row['dialplan_description']) > 0) ? escape($row['dialplan_description']) : " ")."\n"; echo " \n"; if ($app_uuid == "4b821450-926b-175a-af93-a03c441818b1" && permission_exists('time_condition_edit')) { - echo "$v_link_label_edit"; + echo "$v_link_label_edit"; } elseif ( ($app_uuid == "c03b422e-13a8-bd1b-e42b-b6b9b4d27ce4" && permission_exists('inbound_route_edit')) || @@ -357,7 +357,7 @@ ($app_uuid == "16589224-c876-aeb3-f59f-523a1c0801f7" && permission_exists('fifo_edit')) || permission_exists('dialplan_edit') ) { - echo "$v_link_label_edit"; + echo "$v_link_label_edit"; } if ( ($app_uuid == "c03b422e-13a8-bd1b-e42b-b6b9b4d27ce4" && permission_exists('inbound_route_delete')) || @@ -366,7 +366,7 @@ ($app_uuid == "4b821450-926b-175a-af93-a03c441818b1" && permission_exists('time_condition_delete')) || permission_exists('dialplan_delete') ) { - echo "$v_link_label_delete"; + echo "$v_link_label_delete"; } echo " \n"; echo "\n"; @@ -414,7 +414,7 @@ echo "\n";